CVE-2024-2863

Deeper analysis

CVE-2024-2863 is a path traversal vulnerability that affects LG LED Assistant. It stems from improper handling of file uploads, allowing directory traversal as indicated by the associated CWEs (CWE-35 and CWE-22). The flaw carries a CVSS 3.1 base score of 5.3, reflecting network attack vector, low complexity, and no required authentication or user interaction, with a resulting partial confidentiality impact.

Remote, unauthenticated attackers can exploit the issue by submitting crafted file upload requests to the affected LG LED Assistant instance. Successful exploitation enables path traversal that may expose sensitive files outside the intended upload directory, though the vulnerability does not permit modification or deletion of data.

LG has published security bulletins that direct users to available updates for the product; administrators should apply the patches referenced at the LG security site to remediate the flaw.

The EPSS score for this CVE rose from a low baseline to a peak of 0.7129 (current value 0.5613), indicating that exploitation interest increased after public disclosure and that the issue merits renewed monitoring.